Read data from multiple tables

Question

Read data from multiple tables.... . Can anyone figure out why this code won't work... . When I make checkbox selection, the alert (script) is showing up, . I known there should be come a result of data. . Manny thanks, Benny

<?php
 include_once 'dbcon.php';
 if(isset($_POST['chk'])=="")
 {
  ?>
    <script>
  alert('Er moet tenminste één checkbox geselecteerd zijn !!!');
  window.location.href='../EVENT/eventIndex.php';
  </script>
<?php
 }
 $chk = $_POST['chk'];
 $chkcount = count($chk);
?>    
<form method="post" name="frm">
<table width="90%" align="center" border="0">
    <tr>
        <td colspan="6"><a href="NewTicket.php" class="StyleTxt">Voeg een nieuw ticket toe...<br>
        </a></td>
    </tr>
    <tr>
        <th width="15%" class="StyleTxt">Naam</th>
        <th width="15%" class="StyleTxt">Voornaam</th>
        <th width="15%" class="StyleTxt">Partner achternaam</th>
        <th width="15%" class="StyleTxt">Partner voornaam</th>
        <th width="15%" class="StyleTxt">Herbalife-ID</th>
        <th width="15%" class="StyleTxt">Upline</th>
    </tr>
<?php  
for($i=0; $i<$chkcount; $i++)
{
$id = $chk[$i];

$res=$MySQLiconn->query("SELECT user.FName, user.LName, user.HerbalifeID, user.UplineS, registratie.PartnerFName, registratie.PartnerLName, registratie.NaamVIP1, registratie.NaamVIP2, registratie.NaamVIP3, registratie.NaamVIP4, registratie.NaamVIP5, registratie.NaamVIP6, registratie.NaamVIP7, registratie.NaamVIP8, registratie.NaamVIP9, registratie.NaamVIP10, registratie.NaamVIP11, registratie.NaamVIP12 FROM registratie INNER JOIN user ON registratie.userID = user.UserID AND registratie.eventID=".$id);

 while($row=$res->fetch_array())
 {
?>
   <tr>
<td style="background-color:gold;"><?php echo $row['FName'];?></td>
<td style="background-color:gold;"><?php echo $row['LName'];?></td>
<td style="background-color:gold;"><?php echo $row['PartnerFName'];?></td>
<td style="background-color:gold;"><?php echo $row['PartnerLName'];?></td>
<td style="background-color:gold;"><?php echo $row['HerbalifeID'];?></td>
<td style="background-color:gold;"><?php echo $row['UplineS'];?></td><br />
</tr>
<tr>
<td>VIP: <?php echo $row['NaamVIP1'];?></td>
<td>VIP: <?php echo $row['NaamVIP2'];?></td>
<td>VIP: <?php echo $row['NaamVIP3'];?></td>
<td>VIP: <?php echo $row['NaamVIP4'];?></td>
<td>VIP: <?php echo $row['NaamVIP5'];?></td>
<td>VIP: <?php echo $row['NaamVIP6'];?></td>
</tr>
<tr>    
<td>VIP: <?php echo $row['NaamVIP7'];?></td>
<td>VIP: <?php echo $row['NaamVIP8'];?></td>    
<td>VIP: <?php echo $row['NaamVIP9'];?></td>
<td>VIP: <?php echo $row['NaamVIP10'];?></td> 
<td>VIP: <?php echo $row['NaamVIP11'];?></td>
<td>VIP: <?php echo $row['NaamVIP12'];?></td> 
   </tr> 
<?php
  } 
 }
?>

WARNING: You have an [SQL injection](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) vulnerability, and possibly some XSS ones too. — Alexander O'Mara, Jun 02 '16 at 22:40
What is this supposed to do: `if(isset($_POST['chk'])=="")` ? — Mike, Jun 02 '16 at 22:43

Sergio E. Diaz · Answer 1 · 2016-06-03T06:08:50.990

0

Aside from the SQL injection vulnerabilities in your code which I encourage you to read up on (see http://php.net/manual/en/security.database.sql-injection.php) there is a small issue on your code.

if(isset($_POST['chk'])=="")

~~That is not correct, because isset returns a boolean and you cannot compare boolean to string, it is invalid.~~ Check Mike's comment below. If you wanted to check for the string not being empty and set, do:

if(isset($_POST['chk']) && !empty($_POST['chk']))

The manpage for isset is here: http://php.net/manual/en/function.isset.php; "Returns TRUE if var exists and has value other than NULL, FALSE otherwise."

Another small thing: $chk does not default to a value, which means, if it is not provided, the whole script will blow up. To fix this, you can add a default value, using the new syntax in PHP7 but for compatibility:

if (!isset($_POST['chk']) {
    $chk = 'something'
}

edited Jun 03 '16 at 06:08

answered Jun 02 '16 at 23:28

Sergio E. Diaz

396
3
15

*"you cannot compare boolean to string"* - That's not true at all. When comparing a string to a boolean the string is cast to a boolean (`false` for `"0"` or `""` and `true` for everything else). See the loose comparison table [here](http://php.net/manual/en/types.comparisons.php). `if(isset($_POST['chk'])=="")` is the same as `if(isset($_POST['chk'])==false)` or `if(!isset($_POST['chk']))`. It's just very confusing to write it as the OP has it. – Mike Jun 03 '16 at 04:24
Also `if(isset($_POST['chk']) && $_POST['chk'] !== "")` can be simplified to simply `if(!empty($_POST['chk']))` – Mike Jun 03 '16 at 04:25
@Mike wow haha, guess I've been writing too much Python recently. – Sergio E. Diaz Jun 03 '16 at 06:05

Read data from multiple tables

1 Answers1